If I am on two sites with a browser, can one of those sites see what I am doing on the other site?


Yes, if both sites have the same domain and javascript code to do that. No otherwise, unless there's a serious security flaw in your browser or system that is being exploited.

Reference: http://tools.ietf.org/html/draft-abarth-principles-of-origin-00

  • 2
    …for completeness sake, assume that 'security flaw' also includes user-installed viruses, worms, and trojans. ;)
    – kojiro
    Mar 2 '11 at 4:45
  • Not to promote any browser here but Chrome is really good at handling this type of security flaws and was designed from the bottom up with that in mind... (and I don't know about the other browsers but AFAIK IE9 has the worst mechanism for handling this situations).
    – PedroC88
    Mar 2 '11 at 4:53
  • 5
    @PedroC88 Many user agents, certainly all A-list browsers implement the same-origin policy. Do you have some documentation that you're basing your comment on, or are you just a big fan of Chrome?
    – kojiro
    Mar 2 '11 at 4:57
  • I don't, I speak mostly from a user-experience perspective.
    – PedroC88
    Mar 2 '11 at 5:04
  • 2
    @Pedroc88 Can you provide examples from that experience showing that IE9 is worse than chrome in this respect?
    – Joe Taylor
    Mar 2 '11 at 10:57

If all is well, then currently: no, not in the way you describe (simultaneous browser sessions).

But, more general given the title of your question, bugs and privacy leaks might always be exploited. Like today in some browsers, embedding links to the other sites might reveal if you visited those, by abusing an old "visited links" privacy leak. December 2010:

The 46 sites exploit a widely known vulnerability that currently exists in all production version browsers except of Apple's Safari, which earlier this year became the first major browser to insulate users against the threat. Google Chrome, which is based on the same Webkit engine, soon followed. Beta versions of Mozilla Firefox and Microsoft Internet Explorer also fix the problem, but production versions of those browsers are still wide open.

The exploit works by using JavaScript to read cascading style sheet technologies included in virtually every browser that causes visited links to appear in purple rather than blue. Developers have known of the weakness for a decade or more but until recently said it couldn't be easily repaired without removing core functionality.


Depends. If they share tracking code and set everything up to track behavior on both - then yes. Also there are many ways for malware to do so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy